v0.2.0 — resilience, tooling, security

[0.2.0] — 2026-04-22

Added

• Automatic retries with exponential backoff and jitter for 429, 5xx, and network errors. Retry-After (numeric seconds and HTTP-date) is honoured. Configurable via PEOPLEFORCE_MAX_RETRIES (default 3) and PEOPLEFORCE_RETRY_BASE_MS (default 500).
• Per-request timeout via AbortController, configurable with PEOPLEFORCE_TIMEOUT_MS (default 15000). Timed-out requests are retried subject to the retry budget.
• PeopleForceError.attempts — the number of attempts made before the error was raised, for diagnostics.
• Biome for linting + formatting, wired into a dedicated lint CI job.
• CI hardening: explicit permissions: contents: read on all workflow jobs (closes three CodeQL alerts).
• Dependabot config for weekly npm + monthly github-actions updates, grouped into runtime / dev bundles. Major-version npm bumps are ignored by default (security advisories still flow through).
• GitHub community files: issue templates (bug report / feature request / question with PII redaction checklist), PR template, CODEOWNERS, private security contact in issue-template config.
• Social preview image (assets/social-preview.png) plus the reproducible Python generator and the Connective Silence design philosophy.
• Documentation: environment-variable reference table in README, updated .env.example.

Changed

• PeopleForceClient constructor now accepts an options object { baseUrl, timeoutMs, maxRetries, retryBaseMs, fetch, sleep }. The legacy (apiKey, baseUrl: string) signature is still accepted for back-compat.
• Example prompts and tool descriptions no longer reference real employee identifiers or internal emails; placeholders are used throughout.

Security

• Enabled and validated GitHub secret scanning, Dependabot alerts, private vulnerability reporting, and CodeQL default setup against the repository.
• main is protected by a branch ruleset: required PRs, required status checks (lint + 3 test matrix jobs), blocked force-pushes, restricted deletions. Admin bypass limited to pull-request flow.

Tests

• 14 tests total (up from 9). New coverage for exponential backoff, Retry-After parsing, non-retryable status codes, timeout handling, and attempts-counter semantics.